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Abstract 

We propose a new method for proving lower bounds on quantum query algorithms. Instead of a 
classical adversary that runs the algorithm with one input and then modifies the input, we use a quantum 
adversary that runs the algorithm with a superposition of inputs. If the algorithm works correctly, its 
state becomes entangled with the superposition over inputs. We bound the number of queries needed 
to achieve a sufficient entanglement and this implies a lower bound on the number of queries for the 
computation. 

Using this method, we prove two new Q(\/~N) lower bounds on computing AND of ORs and inverting 
a permutation and also provide more uniform proofs for several known lower bounds which have been 
previously proven via variety of different techniques. 

1 Introduction 

In the query model, algorithms access the input only by querying input items and the complexity of the 
algorithm is measured by the number of queries that it makes. Many quantum algorithms can be naturally 
expressed in this model. The most famous examples are Grover's algorithm^ for searching an iV-element 
list with 0(y/~N) quantum queries and period-finding which is the basis of Shor's factoring algorithm [O, p7[ . 

In the query setting, one can not only construct efficient quantum algorithms but also prove lower 
bounds on the number of queries that any quantum algorithm needs. For example, it can be shown that 
any algorithm solving the unordered search problem needs Q(y/~N) queries j|. (This implies that Grover's 
algorithm is optimal.) 

The lower bounds in quantum query model provide insights into the limitations of quantum computing. 
For example, the unordered search problem provides an abstract model for NP-complete problems and 
the $l(\/~N) lower bound of Q provided evidence of the difficulty of solving these problems on a quantum 
computer. 

For two related problems - inverting a permutation (often used to model one-way permutation) and AND 
of ORs only weaker lower bounds have been known. Both of these problems can be solved using Grover's 
algorithm with 0{y/N) queries for inverting a permutation and 0{^/N log N) queries for AND of ORs0. 
However, the best lower bounds have been f2(- v / lv)0] and il(\/~N), respectively. 

We present a new method for proving lower bounds on quantum query algorithms and use it to prove 
Q(y/N) lower bounds for inverting a permutation and AND of ORs. It also provides a unified proof for 
several other results that have been previously proven via variety of different techniques. 

'Supported by Berkeley Fellowship for Graduate Studies and, in part, by NSF grant CCR-9800024. This research was done 
while visiting Microsoft Research. 
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In contrast to j|, |l8[ that use a classical adversary argument (an adversary runs the algorithm with one 
input and, after that, changes the input slightly so that the correct answer changes but the algorithm does 
not notice that), we use a quantum adversary. In other words, instead of running the algorithm with one 
input, we run it with a superposition of inputs. This gives stronger bounds and can also simplify the proofs. 

More formally, we consider a bipartite quantum system consisting of the algorithm and an oracle an- 
swering algorithm's queries. At the beginning, the algorithm part is in its starting state (normally |0)), the 
oracle part is in a uniform superposition over some set of inputs and the two parts are not entangled. 

In the query model, the algorithm can either perform a unitary transformation that does not depend 
on the input or a query transformation that accesses the input. The unitary transformations of the first 
type become unitary transformations over the algorithm part of the superposition. The queries become 
transformations entangling the algorithm part with the oracle part. 

If the algorithm works correctly, the algorithm part becomes entangled with the oracle part because the 
algorithm part must contain different answers for different inputs. We obtain lower bounds on quantum 
algorithms by bounding the number of query transformations needed to achieve such entanglement. 

Previously, two main lower bound methods were classical adversary W (called 'hybrid argument' in 18 ) 
and polynomials methods. The classical adversary/hybrid method of j|, Q starts with running the algorithm 
on one input. Then the input is modified so that the behavior of algorithm does not change much but the 
correct answer does change. That implies that the problem cannot be solved with a small number of queries. 
Polynomials method|| uses the fact that any function computable with a small number of queries can 
be approximated by a polynomial of a small degree and then applies results about inapproximability by 
polynomials. 

Our "quantum adversary" method can be used to give more unified proofs for many (but not all) results 
that were previously shown using different variants of hybrid and/or polynomials method. 

There is also a new proof of the f2(\/iV) lower bound on unordered search by Groverpi)]. This proof is 
based on considering the sum of distances between superpositions on different inputs. While the motivation 
for Grover's proof (sum of distances) is fairly different from ours (quantum adversary), these two methods 
are, in fact, closely related. We discuss this relation in section [?]. 



2 The model 

We consider computing a Boolean function f(xi, . . . , xjy) : {0, 1}^ — ► {0, 1} in the quantum query modcljjj. 
In this model, the input bits can be accessed by queries to an oracle X and the complexity of / is the number 
of queries needed to compute /. 

A quantum computation with T queries is just a sequence of unitary transformations 

Ua^O^U^O^...^ U T -i -^O^U T - 

Uj's can be arbitrary unitary transformations that do not depend on the input bits x\ 1 . . . , xm- O are 
query (oracle) transformations. To define O, we represent basis states as \i, b, z) where i consists of [log AT] 
bits, b is one bit and z consists of all other bits. Then, O maps \i,b, z) maps to \i, b(B Xi,z). (i.e., the first 
[log A] bits are interpreted as an index i for an input bit Xi and this input bit is XORed on the next qubit.) 
We use O x to denote the query transformation corresponding to an input x — {x\, . . . , x n ). 

Also, we can define that O maps \i,b, z) to (—l) b ' Xi \i,b, z) (i.e., instead of XO Ring Xi on an extra qubit 
we change phase depending on xC). It is well known that both definitions are equivalent up to a constant 
factor: one query of the 1 st type can be simulated with a one query of the 2 nd type and one query of the 2 nd 
type can be simulated with 2 queries of the 1 st type. For technical convenience, we use the 2 nd definition in 
most of this paper. 

The computation starts with a state |0). Then, we apply Uq, O, . . ., O, Ut and measure the final state. 
The result of the computation is the rightmost bit of the state obtained by the measurement. 
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The quantum computation computes / with bounded error if, for every x — (xi, . . . , xn), the probability 
that the rightmost bit of UtO x IIt-i ■ ■ ■ O x Uo\0) equals f{x\, . . . ,xn) is at least 1 — e for some fixed e < 1/2. 

This model can be easily extended to functions defined on a larger set (for example, {1, . . . ,N}) or 
functions having more than 2 values. In the first case, we replace one bit b with several bits ([log TV] bits in 
the case of {1, ... , N}). In the second case, we measure several rightmost bits to obtain the answer. 

3 The main idea 

Let S be a subset of the set of possible inputs {0, 1} N . We run the algorithm on a superposition of inputs in 
S. More formally, let Ha be the workspace of the algorithm. We consider a bipartite system H — Ha <8> Hi 
where Hi is an "input subspace" spanned by basis vectors |x) corresponding to inputs x € S. 

Let UtOUt-i ■ ■ ■ U be the sequence of unitary transformations on Ha performed by the algorithm 
A (with U ,...,Ut being the transformations that do not depend on the input and O being the query 
transformations). We transform it into a sequence of unitary transformations on H. A unitary transformation 
Ui on Ha corresponds to the transformation U- = Ui <g> I on the whole H. The query transformation O 
corresponds to a transformation O' that is equal to O x on subspace Ha ® |x). 

We perform the sequence of transformations U' t O'U' t _ x ... [/q on the starting state 

\lpstart) = |0) ® y] a x \x). 

Then, the final state is 

|Vw) = ^2a x \ip x ) <g> \x) 

where \ip x ) is the final state of A = UtOUt-i ■ ■ - Uq on the input x. This follows from the fact that 
the restrictions of XJ' T , O' , U' T _ X , . . . ,U' Q to Ha ® \x) are Ut, O x , Ut-i, ■ ■ ■, Uq and these are exactly the 
transformations of the algorithm A on the input x. 

In the starting state, the Ha and Hi parts of the superposition are unentanglcd. In the final state, 
however, they must be entangled (if the algorithm works correctly). To sec that, consider a simple example 
where the algorithm has to recover the whole input. 

Let a x — 1/^/rn (where m = |5|) for all x € S. In the exact model (the algorithm is not allowed to 
give the wrong answer even with a small probability), \ip x ) must be |a;)|<^a;) where |x) is the answer of the 
algorithm and \(p x ) are algorithm's workbits. This means that the final state is 

-P= Y] \x)\<Px) ® \x), 

i.e., it is fully entangled state. In the bounded error model (the algorithm can give a wrong answer with a 
probability at most e), \ip x ) must be (1 — e)\x)\tp x ) + \ip' x ) and the final state must be 

-±= £((l-e)|x)K) + |<»®|x> 
v m xeS 

which is also quite highly entangled. 

In the general case (we have to compute some function / instead of learning the whole input x) , the parts 
of Hi corresponding to inputs with /(x) = z must become entangled with parts of Ha corresponding to the 
answer z. 

Thus, we can show a lower bound on quantum query algorithms by showing that, given an unentan- 
glcd start state, we cannot achieve a highly entangled end state with less than a certain number of query 
transformations. 
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Next, we describe more formally how we bound this entanglement. If we trace out Ha from the states 
\ipstart) and \ip e nd), we obtain mixed states over Hi- Let p s tart and p en d be the density matrices describing 
these states. 

Pstart is a to x to matrix corresponding to the pure state X^eS a x\x). Entries of this matrix are 
{pstart)xy — ^x^v In particular, if the start state is -^i= Smgs au entries of the p s tart are 1/to. 
For p en d we have 

Lemma 1 Let A be an algorithm that computes f with probability at least 1 — e. Let x, y be such that 
f(x)^f(y). Then, 

\(Pend)xy\ < 2yJ7(T~e)\a x \\a y \. 

Proof: Let \ip x )i l^y) be the final superpositions of the algorithm A on inputs x.y. We take a basis for 
Ha consisting of the vectors of the form \z)\v) where \z) is a basis for the answer part (the part which is 
measured at the end of algorithm to obtain the answer) and \v) is a basis for the rest of Ha (wor kbits). We 
express l^) and \ip y ) in this basis. Let 

\i>x) = ^a z ^ v \z)\v), \ip y ) = ^2b z>v \z)\v). 

z,v z,v 

The final state of the algorithm is J2xes a x\^x) ® \x). By tracing out Ha in the \z)\v) basis, we get 

i,Pend)xy — C^x^y ^ ®z.v^ z > v ' 

z,v 

Define ei = J2z.v.z^f(x) \ a z,v\ 2 and e 2 = J2z.v.z=f(x) l^z, v\ 2 - Then, e± < e and e 2 < e (because these are 
the probabilities that the measurement at the end of algorithm gives us a wrong answer: not f(x) for the 
input x and fix) for the input y). We have 

I < \a z 

E \ a * 

,v 1 1 &z,v I + E \ a z,v\\b z ^ v | 
Z,v z.v z,v:z=f(x) z,v:z^f(x) 



< E mJ E im 2 + / E m E \Kv\ 2 = V(i-ti)t2 + A/ci(i-e 2 ). 

V z,v.z=f(x) V z,v.z=f(x) V z,v:z^f(x) Vz,v:z^f{x) 



This expression is maximized by e\ — e 2 = e, giving us 2y/e(l — e). Therefore, 

KPendW = KIKH^ a z,A/ul - 2 V /e ( 1 - e )|axlKI- 

□ 

In particular, if \tp s t a rt) is the uniform XLgs I 2 ')' we nave {p en d)xy < 2ye(l — ej/m. Note that, for 
any e < 1/2, 2y^e(l — e) < 1. Thus, if the algorithm A works correctly, the absolute value of every entry 
of Pend that corresponds to inputs x,y with f(x) ^ f(y) must be smaller than the corresponding entry of 
Pstart by a constant fraction. 

To prove a lower bound on the number of queries, we bound the change in p xy caused by one query. 
Together with Lemma |l|, this implies a lower bound on the number of queries. 
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4 Lower bound on search 



Next, we apply this technique to several problems. We start with the simplest case: the lower bound on 
unordered search problem (Theorem Q). Then, we show two general lower bound theorems (Theorems ^ and 

D- 

Each of these theorems is a special case of the next one: Theorem |^ implies Theorem [j] and Theorem ^ 
implies Theorem ^. However, more general theorems have more complicated proofs and it is easier to see the 
main idea in the simple case of unordered search. Therefore, we show this case first, before general theorems 
§ and |[ 

Problem: We are given x±, . . . , xn G {0, 1} and we have to find i such that a;, = 1. 

Theorem 1 Any quantum algorithm, that finds i with probability 1 — e uses £l(y/~N) queries. 

Proof: Let S be the set of inputs with one x± equal to 1 and the rest 0. Then, |5| = N and Hi is an 
iV-dimensional space. To simplify the notation, we use \i) to denote the basis state of Hi corresponding to 
the input (xi, . . . , xjv) with Xi = 1. 

Let pk be the density matrix of Hi after k queries. Note that po = p s tart and px = Pend- We consider 
the sum of absolute values of all its off-diagonal entries Sk — J2 X y x^y \{Pk)xy\- We will show that 

1. S = N-1, 

2. S T < 2y / e(i - e)(N - 1) 

3. S k -i - S k < 2yW^T for all k G {1, . . . , T}. 

This implies that the number of queries T is at least (1 — 2ye(T— e))\/N — 1/2. 

The first two properties follow straightforwardly from the results at the end of section ||. N x N matrices 
Pi have N(N — 1) non-diagonal entries and each of these entries is 1/N in p start and at most I^J e(\ — e)/N 
in p en d (Lemma [l] together with the fact that each of these entries corresponds to two inputs with different 
answers). 

It remains to prove the third part. First, notice that 

S k -1-S k = \(Pk-l)x V \- \{Pk)xy\< Y \(Pk-l)xy ~ (Pk)xy\- 

x,y:x^y x,y:x^y x,y:x^y 

Therefore, it suffices to bound the sum of \{pk—i)xy ~ {pk)xy\- 

A query corresponds to representing the pure state before the query as 

\tpk-i) = Y y/Pi^\h z ) ® \i>i,z), 
i,z 

and changing the phase on the \i) component of \ipi tZ ). If we consider just the Hi part, the density matrix 
Pk-i before the query is 5-) i>a Pi, z |V , i,*)W'»,*l < Tne density matrix p k after the query is Y,i,z Phzl^z) (^i,z\ 
where 

Consider p liZ = \ip itZ ) (ip itX | and p' i z = \ip'i tZ )(ip' itZ \- Then, p k -i = Y*i, z P%zP%z and Pk = J2i, z PhzPi, z - 
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The only entries where pi tZ and p\ z differ are the entries in the i th column and the i th row. These entries 
are a* ^cti,z,i in Pi,z and -ct*, z jCti,z,i in p' iz - The sum of absolute values of the differences of all entries in 
the i th row is _ 

y^ 2 l a i,z,7 a wl ^ 2 l a wl^l a *,«,j'l- 

Similarly, the sum of absolute values of the differences of all entries in the i th column is at most 2|a ijZji | J2j^i \ a i,z,j 
as well. So, the sum of absolute values of all differences is at most 4|aj ;Z; j| J2j^i \ a i,z,j\- 
By Cauchy-Schwartz inequality, 



j¥* V 



Therefore, 



Define 5 i;2 = X^.^ KPi.z)^ - (Pi.Jxyl- Then, we have just shown S i;2 < 2V^V - 1. This implies a 
bound on the sum T, x ,y. X7 ty \(pk -l)xy {pk)xy\- 

\(Pk-l)xy ~ {Pk)xy\ = \^2PiAPi,z)xy-^2pi,z{Pi,z)xy\ 
x,y:x^y x.y.x^y i,z i.z 

J2 \{Pi,z)xy ~ {p'i, z )xy\ < J^Pi^y/N - 1 = 2VN - 1. 

z,z x,y:x^y i : z 

This completes the proof. □ 

5 The general lower bound 
5.1 The result 

Next, we obtain a general lower bound theorem. 

Theorem 2 Let f(x\, . . . , x^) be a function ofn {0, l}-valued variables and X, Y be two sets of inputs such 
that f(x) ^ f(y) if x E X and y G Y. Let R C X x Y be such that 

1. For every x G X , there exist at least m different y eF such that (x, y) G R. 

2. For every y &Y, there exist at least m' different x G X such that (x,y) G R. 

3. For every x G X and i G {l,...,n}, there are at most I different y G Y such that (x,y) G R and 
Xi ^ y l . 

4- For every y G Y and i G {1, . . . ,n}, there are at most I' different x G X such that (x,y) G R and 
Xi ^ yi. 

Then, any quantum algorithm computing f uses 2 ffr-") queries. 
Proof: Consider the set of inputs S = IUY and the superposition 

over this set of inputs. Let Si be the sum of over all x,y such that (x,y) G R. Then, the theorem 

follows from 
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1. So - S T > (1 - 2^/e(l - e))v / ^ 7 

2. 5 fe _i ~S k <VW 



To show the first part, let G R. Then, (p )x y = ^ ||y| and |(pt)^| < ^^nyf (Lemma 0). 

Therefore, 

\(pa)xy\ - \{pt)x V \ > - — 7== - • 

v l A ll y I 

The number of (x, y) £ R is at least max(|X|?7i, |F|m') because for every x £ X, there are at least m possible 
y £ Y and, for every y £ Y, there are at least m! possible x £ X. We have 

max(|X|m, \Y\mf) > |X|m + |F|m ' > vl^p^W, 



So - S T > J\X\\Y\mm'- — 2 ^ £ ^ ^ = (1 - 2^(1 - e^vmm 7 
Next, we prove the second part. Similarly to the previous proof, we represent 



^2,2;, a; | ^/ • 
x£S 



A query corresponds to changing the sign on all components with Xi = 1. It transforms \ipi, z ) to 

Wi, z ) = E a ^A x ) - E "wl 33 )- 



Let p v = \ipi, z ){i/ji, z \ and = |V>L)«J- We define S i>z = E(x,j,)£fi \(Pi,*)xv ~ {p'i, z )xy\- 

If = i/i, then {pi t z)xy and (X^xj, are the same. If one of Xi, yi is and the other is 1, {pi, z )xy = 
-(Pi, z )xy and \{pi, z ) xv - (p'i, z )xy\ = 2\(pi, z )x V \ = 2\a i<z , x \ \a itZt y\. Therefore, 

Si, z = 2\oti,z,x\\ati,g, y \ < E \lj\ a i,z,x\ 2 + \JJ;\ai, z ,y\ 2 

(x,y)£R:Xi^yi (x,y)£R:Xi^yi 

xex y eY xexuY 

Similarly to the previous proof, this implies the same bound on Sk-i — S^. □ 



5.2 Relation to block sensitivity bound 

Our Theorem || generalizes the block sensitivity bound of [|[ [l8| . 

Let / be a Boolean function and x = (xi, . . . , x n ) an input to /. For a set 5 C {1, ... , n}, x^ s ' denotes 
the input obtained from x by flipping all variables Xi, i £ S. / is sensitive to S on input x if f(x) ^ f(x^ s '). 

The block sensitivity of / on input x is the maximal number t such that there exist t pairwise disjoint 
sets Si, S2, ■ ■ ., St such that, for all i £ {1, . . . , t}, f is sensitive to Si on x. We denote it by bs x (f). The 
block sensitivity of /, bs(f) is just the maximum of bs x (f) over all inputs x|H. 
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The orem 3 \fiy Let f be any Boolean function. Then, any quantum query algorithm computing f uses 
Q,(y/bs(f)) queries. 

To see that this is a particular case of Theorem @, let x be the input on which / achieves bs(f) block 
sensitivity. Then, we can take X = {x} and Y = {x^ *\ . . . , x( Si>s (/)'}. 

Let R = {(x,x( Sl 1), (x,a; (S2) ), . . . , (x, x^/)))}. Then, m = bs(f), ml = 1. Also, I = 1 (because, by the 
definition of the block sensitivity, m blocks of input variables have to be disjoint) and I' = 1. Therefore, we 
get ^ip^- = bs(f) and Theorem || gives the fi(^/6s(/)) lower bound for any Boolean function /. 

In the next subsection we show some problems for which our method gives a better bound than the 
block-sensitivity method. 

5.3 Applications 

For a first application, consider AND of ORs: 

f{xi,...,x N ) = {xiORx 2 ■ • ■ ORx ^)AND 

(^+i ■ • ■ x 2 Vn) AND ■ ■ ■ and ( x n-Vn+i or ■ ■ ■ ORx N ) 
where x%, . . . , xn £ {0, 1}. 

/ can be computed with 0(VN log N) queries by a two-level version of Grover's algorithm (see 0). 
However, a straightforward application of lower bound methods from |4|, ^ only gives an Q,(\/N) bound 
because the block sensitivity of / is 6(v / iV) and the lower bound on the number of queries given by hybrid 
or polynomials method is the square root of block sensitivity [l^]. Our method gives 

Theorem 4 Any quantum algorithm computing AND of ORs uses Q(y~N) queries. 

Proof: For this problem, let X be the set of all x = {x%, . . . , x n ) such that, for every i 6 {1, . . . , yN}, 
there is exactly one j € {1, . . . , \/n} with £(i_i) v /]v+j = 1- Y is the set of all y = (yi, . . . ,y n ) such that 
%-i)yiv+i = • • • = Ui^/W = f° r some i and, for every i' ^ i, there is a unique j S {1, . . . , v~N} with 
y<i— i)VJV+j = 1- ^ consists of all pairs (x, y), x £ X, y £ Y such that there is exactly one i with x^ ^ j/,-. 

Then, m = ml = \fn because, given x <E X, there are ^/n Is that can be replaced by and replacing 
any one of them gives some y G Y . Conversely, if y € Y, there are y/n ways to add one more 1 so that we 
get x G X. On the other hand, I = I' = 1 because, given x £ X (or y £ Y) and i £ {1, . . . , n}, there is only 

one input that differs from x only in the i th position. Therefore, \J~^fp^- — \pn and the result follows from 
Theorem ||. □ 

Our theorem can be also used to give another proof for the following theorem of Nayak and WuJIJ]. 

Theorem 5 fT^j Let f : {0, 1, . . . , n — 1} — > {0, 1} be a Boolean function that is equal to 1 either at exactly 
n/2 points of the domain or at exactly (1 + e)n/2 points. Then, any quantum algorithm that determines 
whether the number of points where f(x) = 1 is n/2 or (1 + e)n/2 uses queries. 

This result implies lower bounds on the number of quantum queries needed to compute (or to approx- 
imate) the median of n number s [p^|. It was shown in [[u| using polynomials method. No proof that uses 
adversary arguments similar to |4|, p_8| is known. 

With our "quantum adversary" method, Theorem ^ can be proven in similarly to other theorems in this 
paper. 

Proof: Let X be the set of all / that are 1 at exactly n/2 points, Y be the set of all / that are 1 at (l + e)n/2 
points and R be the set of all (/, /') such that f £ X, f £ Y and they differ in exactly en/2 points. 
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Then, m = ( n/ %) and m' = ( (1+e) " /2 ). On the other hand, I = ( n/ f~\) and I' = ( (1+£) / " /2 r 1 ) ■ Therefore, 

' \en/2/ V en/2 / ' Ven/2— 1/ V en/2— 1 / 3 

mm \e n/2J \ en/2 I _ g 2 _ 1 + 6 > Ji 



/2-lW(l+e)r»/2-l^ S £2 £ 2 £ 2 



V c n / 



/2-lA en/2-1 



2 2 



By Theorem Q, the number of queries is ^i(y = fi(l/e). 

□ 

There are several other known lower bounds that also follow from Theorem ^| In particular, Theorem | 
implies ft(N) lower bounds for MAJORITY and PARITY of §. 



6 Inverting a permutation 

6.1 Extension of Theorem 2 

For some lower bounds (like inverting a permutation) , we need a following extension of Theorem |2|. This is 
our most general result. 

Theorem 6 Let f(x%, . . . , xn) be a function of n variables with values from some finite set and X, Y be two 
sets of inputs such that f(x) ^ f(y) if x G X and y 6 Y . Let R C X x Y be such that 

1. For every x S X, there exist at least m different y G Y such that (x,y) G R. 

2. For every y G Y . there exist at least mf different x G X such that (x, y) G R. 

Let l Xi i be the number ofyGY such that (x,y) G R and x$ ^ yi and l y j be the number of x G X such that 
(x, y) G R and Xi ^ y%. Let l max be the maximum of l x ,ily,i over all (x, y) G R and i G {1, . . . , N} such that 

x i 7^ y%- Then, any quantum algorithm computing f uses f2(^/ ZHoL} queries. 

The parameters I and I' of Theorem || are just max X £x,i lx,i an d max 9 gy, t l y ^. It is easy to see that 

max lx,ily,i ^ max £ max 2 ■ 

(x,y)£R,Xi^yi ' x,i ' y,i 

Therefore, the lower bound given by Theorem |6| is always greater than or equal to the lower bound of 
Theorem |^. However, Theorem ^ gives a better bound if, for every [x, y) G R and i, at least one of l x .% or 
l Vt i is less than its maximal value (which happens for inverting a permutation). 

Also, Theorem || allows {1, . . . , Y}-valued variables instead of only {0, l}-valued in Theorem [| 
Proof: Similarly to Theorem ||, we consider the set of inputs S — X UY and the superposition 

over this set of inputs. Let Sk be the sum of |(/?fc)xvl over all x,y such that (x,y) G R. The theorem follows 
from 



1. St-Sq>(1- 2y/e(l - e))Vmm' 



2. Sk-l — Sk < \/lr, 
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The first part is shown in the same way as in the proof of Theorem Q For the second part, express the 
state before the k th query as 

IV>fc-i) = E a ^a,z,x\i,a,z) <g) \x) 

i,a,z,x 

where i is the index of the input variable Xi being queried, a are log N bits for the answer, z is the part of 
Ha that does not participate in the query (extra workbits) and x is H.i part of the superposition. A query 
changes this to 



i,a(D Xi, z) <x> \x t 



a, z) <X> x) 



Denote 



\lpi,a,z) = ^ a »,<t,^|a;>, Wi,a,z) = ^2 a i,a®Xi,z,x\ X )- 



pk-i,i = Y^a.z \^%a,z){^i,a,z\ and p k j = J^a.z Wi,a,z) Wi,a,s I are tne P arts of Pk-i and Pk corresponding to 
querying i. We have p k -i = Yh=i Pk-i,i and p k = Yh=i Pk.i- 

Let Sk,i be sum of absolute values of differences \(p k -i,i)xy — {pk,i)xy\ over all (x, y) € R. Then, for every 

x,y, 

\(Pk-l)xy\ ~ \{Pk)xy\ < \{Pk-l)xy ~ (Pk)xy\ = \ }XPk-l,i)xy ~ / ](Pk,i)xy\ < E \{Pk-l,i)xy - (Pk,i)xy\- 

i i i 

Therefore (by summing over all such x and y), S k -i — S k < Sk,i and we can bound S k —i — S k by bounding 

S kl i ■ 

Let x, y be two inputs such that Xi = yi- Then, it is easy to see that 

(Pk-l,i)xy — y t a i,a,z,x a i,a,z,y = ^ ] 0L i,a(Sx i ,z,x a i,a<$ Vi ,z,y = (Pk,i)xy 



Therefore, the only non-zero entries in Sk,i are the entries corresponding to (x,y) € R with xi ^ yi. The 
sum of their differences \{pk-\,i)xy ~ {Pk,i)xy\ is at most the sum of absolute values of such entries in pk-i,i 
plus the sum of absolute values of them in p/.^. We bound these two sums. 
First, any density matrix is semipositive definite. This implies that 



\{Pk-l,i)xy\ < 



1 / I 




\(pk-i,i)xx\ + \l -r^KPk-hijyyl 



for any x and y. Therefore, 

E \(Pk-l,i)xy\ < -X E \ -j—\(Pk-l,i)xx\ + J f^\{pk-\,i)yy\ = ~X E l x,i\ -j—\{pk-l,i)a 



'■c,y-(x,y)eR 
Xi^yi 



x,y-(x,y)eR 
Xi^yi 



xeXuY 



-Trp k _ 



— 2 y/^x,ily,i\(Pk-l,i)xx\ < ^\/hnax \(pk-l,i)xx\ 

xeXUY xGXuY 

The same argument shows that a similar sum is at most ^ l ™ a * Trp k ^ for the matrix p k ^. Therefore, 



Sk-i - S k < E Sk,i < E ^ l ™ ax (Trpk-14 + Trp k ,. 

i i 

This completes the proof. □ 



-(Trpk-i + Trpk) = Vh. 
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6.2 Application 

We use Theorem^ to prove a lower bound for inverting a permutation[Q. 

Problem: We are given xi, . . . , xjv € {1, . . . , N} such that (xi, . . . , xn) is a permutation of {1, . . . , N}. We 
have to find the i such that Xi = 1. 

This problem was used in [Q to show NP A n co — 7VP A ^ BQP A for an oracle A It is easy to see that 
it can be solved by Graver's algorithm (search for i with x^ = 1). This takes 0{yN) queries. 

However, the f2(-\/A0 lower bound proof for search problem from Q does not work for this problem. || 
showed a weaker l^v/iV) bound with a more complicated proof. 



Theorem 7 Any quantum query algorithm that inverts a permutation with probability I — e uses Q(\/N) 
queries. 

Proof: Let X be the set of all permutations x with Xi = 1 for an even i and Y be the set of all permutations 
y with yi = 1 for an odd i. (x,y) € R if x = (xi, . . . , xjv), 2/ = (j/i, ■ ■ ■ ,Vn) an d there are i ^ j such 
that Xi = yj = 1, Xj = j/i and all other elements of x and y are the same. 

For every there are m = n/2 y with (x, y) £ i?. Similarly, for every y G T, there are m' = n/2 x 

such that (x, y) € i?. 

Finally, if we take a pair (x, y) £ R and a location z such that Xj 5^ J/i, then one of Xj, is 1. We assume 
that Xi = 1. (The other case is similar.) Then, there are n/2 y' such that (x,y') € R and x, ^ y^. However, 
the only x' such that (x', y) £ R and x[ ^ yj is x = x. (Any x' such that (x', y) € R and x^ ^ must also 
have x'j ^ j/j where j is the variable for which yj — 1 and x is the only permutation that differs from y only 
in these two places.) 

Therefore, = n/2, l y i = 1 and l max = n/2. By Theorem^, this implies that any quantum algorithm 
needs Vl(^J~^-) — Q(yfn) queries. □ 

7 Relation to Grover's proof 

Graver jlOj presents a proof of the £l(^Jn) lower bound on the search problem based on considering the sum 
of distances 

A(t)= E H^-^oll 2 

i,j£{l,...,n},i^j 

where <j)\ is the state of the algorithm after t queries on the input x\ = . . . = x;_i = 0, x, = 1, Xj + i = . . . = 
x n = 1 and (fy is the state of the algorithm after t queries on the input x\ = . . . = x n = 0. 

Grover shows that, after t queries, A(t) < 4t 2 . If the algorithm outputs the correct answer with proba- 
bility 1, the final vectors <p[, . . ., (fa have to be orthogonal, implying that A(t) > 2N — 2\/N (cf. jn^). This 
implies that the number of queries must be fi(ViV). 

A similar idea (bounding a certain sum of distances) has been also used by Shi fill to prove lower bounds 
on the number of quantum queries in terms of average sensitivity. 

These "distance-based" ideas can be generalized to obtain another proof of our Theorems [2] and ||. 
Namely, for Theorem |[ one can take 



(x,y)eR 



where (f> x , cj) are the states of the algorithm after t steps on the inputs x and y. Then, 



||^-^|| 2 = l-(4l^) 2 - 
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Let pt be the density matrix of "Hi after t steps. By writing out the expressions for (cf> x \ <ff ) and (pt)xy, we 
can see that 

(Pt)w = 4\X\\Y\ 

This shows that the two quantities (the sum of entries in the density matrix and the sum of distances) are 
quite similar. Indeed, we can give proofs for Theorems ^| and ^ in terms of distances and their sums A(£). 
(Namely, A(0) = before the first query, A(T) should be large if the algorithm solves the problem with 
T queries and we can bound the difference A(i) — A(t — 1). This gives the same bounds as bounding the 
entries of density matrices.) 

Thus, Theorems)^ and g have two proofs that are quite similar algebraically but come from two completely 
different sources: running a quantum algorithm with a superposition of inputs (our "quantum adversary") 
and looking at it from a geometric viewpoint (sum of distances). 

The "quantum adversary" approach may be more general because one could bound other quantities 
(besides the sum of entries in the density matrix) which have no simple geometric interpretation. 



8 Conclusion and open problems 

We introduced a new method for proving lower bounds on quantum algorithms and used it to prove tight 
(up to a multiplicative or logarithmic factor) lower bounds on Grover's search and 3 other related problems. 
Two of these bounds (Grover's search and distinguishing between an input with 1/2 of values equal to 1 and 
1/2 + e values equal to 1) were known before. For two other problems (inverting a permutation and AND of 
ORs) , only weaker bounds were known. One advantage of our method is that it allows to prove all 4 bounds 
in a similar way. (Previous methods were quite different for different problems.) 
Some open problems: 

1. Collision problem [||]. 

We are given a function / : {1, . . . ,n} — + {1, . . . , n/2} and have to find i, j such that f(i) = f(j). 
Classically, this can be done by querying f(x) for 0(y/n) random values of x and it is easy to see 
that this is optimal. There is a quantum algorithm that solves this problem with 0{\fn) queries [0. 
However, there is no quantum lower bound at all for this problem (except the trivial bound of f2(l)). 

The collision problem is an abstraction for collision-resistant hash functions. If it can be solved with 
O(logn) queries, there no hash function is collision-resistant against quantum algorithms. 

The exact argument that we gave in this paper (with bounding a subset of the entries in the density 
matrix) does not carry over to the collision problem. However, it may be possible to use our idea of 
running the algorithm with a superposition of oracles together with some other way of measuring the 
entanglement between the algorithm and the oracle. 

2. Simpler/better lower bound for binary search. 

It may be possible to simplify other lower bounds proven previously by different methods. In some 
cases, it is quite easy to reprove the result by our method (like Theorem ||) but there are two cases in 
which we could not do that. The first is the bound of || on the number of queries needed to achieve 
very small probability of error in database search problem. The second is the lower bound on the 
ordered search^]. It seems unlikely that our technique can be useful in the first case but there is a 
chance that some variant of our idea may work for ordered search (achieving both simpler proof and 
better constant under big-fi). 

3. Communication complexity of disjointness. 



12 



Quantum communication complexity is often related to query complexity |Q. Can one use our method 
(either "quantum adversary" or distance-based formulation) to prove lower bounds on quantum com- 
munication complexity? 

A particularly interesting open problem in quantum communication complexity is set disjointness. 
The classical (both deterministic and probabilistic) communication complexity of set disjointness is 
There is a quantum protocol (based on Grover's search algorithm) that computes set 
disjointness with an 0(^/n log n) communication |?J but the best lower bound is only fi(logn)|^|, ||. 

Acknowledgements. I would like to thank Dorit Aharonov, Daniel Gottesman, Ashwin Nayak, Umesh 
Vazirani and Ronald de Wolf for useful comments. 
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